Pith. sign in

REVIEW 2 major objections 5 minor 16 references

A Survey on Facial Image Privacy Preservation in Cloud-Based Services

T0 review · 2 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A structured review of facial-image privacy protection, organized as image obfuscation versus adversarial perturbation, with quantitative benchmarks of six perturbation methods.

desk verdict A readable survey with a modest re-run of six methods, but the quantitative comparison is unreliable for Fawkes and the 'comprehensive' claim outruns the coverage. read the letter →

arxiv 2501.08665 v1 pith:ISBWFU7A submitted 2025-01-15 cs.CV

Chen Chen , Mengyuan Sun , Xueluan Gong , Yanjiao Chen , Qian Wang This is my paper · ORCID
classification cs.CV
keywords facialimageprivacycloud-basedservicesobfuscationadversarialperturbationfacerecognitionunlearnableexamplesprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey aims to give cloud-service users a reliable map of how to keep their facial images from being learned by face recognition models. It sorts the field into two families: image obfuscation, which blurs, re-generates, or masks facial identity, and adversarial perturbation, which adds tiny noise that makes images 'unlearnable.' The authors run a qualitative comparison across practical dimensions such as open-set recognition, real-time speed, and scalability, and a quantitative comparison of six perturbation methods measuring both how often protection defeats a recognizer and how similar the protected image looks. A reader who wants to know which published method to try, or where the field is failing, gets a structured answer.

What carries the argument

The central machinery is a two-way taxonomy paired with a standardized evaluation protocol: protection success rate (the fraction of protected images that a face recognizer misidentifies) measured together with structural similarity (how close the protected image looks to the original to the human eye). The quantitative part runs the released implementations of EM, REM, OPOM, APF, Fawkes, and TIP-IM under shared settings—CASIA-WebFace with Inception ResNet for the non-auxiliary group, LFW with ArcFace for the auxiliary group, a uniform perturbation budget of 0.03, and averaged SSIM—so that the methods' privacy and quality trade-offs are compared on a common footing.

What would settle it

Re-running the six perturbation methods with each method's own recommended hyperparameters instead of the uniform budget and finding a different PSR/SSIM ranking, for example Fawkes outprotecting APF, would undercut the survey's comparative conclusions.

Watch

Extended reading notes

Core claim

The paper's central claim is that current facial-image privacy protection in cloud services falls into two distinct technical families, and that they trade off differently. Image obfuscation methods (makeup transfer, latent-space blurring, diffusion-based anonymization, optical encoders) can hide identity from commercial APIs and support open-set scenarios, but often at the cost of visual fidelity, scalability, or real-time speed. Adversarial perturbation methods (error-minimizing noise, class-wise masks, universal filters, identity masks) keep images visually close to the original, and the survey's own runs of the released code show that among methods needing no auxiliary data, REM reaches about 88% protection success rate at 90.8% SSIM, while among auxiliary-data methods TIP-IM reaches about 94% at 90.9% SSIM, balancing protection with image quality better than APF and Fawkes under the stated protocol. This balance is the paper's evidence that no single method dominates; the choice depends on the threat model and quality budget.

Load-bearing premise

The comparison assumes that running each method's published code under the same benchmark settings gives numbers that fairly represent how well the method would work in real cloud use.

Editorial extensions

If this is right

  • A user who wants to publish a selfie without feeding a commercial face recognizer can apply an adversarial perturbation such as REM or TIP-IM and keep the image visually close to the original.
  • Image obfuscation methods such as makeup transfer or diffusion-based anonymization are better suited when the goal is open-set or whole-scene protection, but they must be checked for visual artifacts and compute cost.
  • Most adversarial perturbation methods protect against close-set training on the protected images themselves; they are not designed to stop a recognizer that already has clean images of the same person from other sources.
  • The survey's standardized PSR/SSIM protocol gives future method developers a concrete baseline to report against, which should make cross-paper comparisons easier.
  • Video, surveillance-like conditions, and training pipelines with data augmentation remain open gaps, so current protection should be considered partial rather than permanent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A hybrid pipeline that combines perturbation for identity unlearnability with obfuscation for attribute-level privacy is a natural next step that the paper describes but does not itself evaluate.
  • Because the quantitative comparison fixes one perturbation budget for all methods, methods tuned for larger or smaller budgets could be misranked; testing each method at its native budget is a concrete follow-up.
  • The survey's finding that few methods handle open-set recognition suggests that cloud vendors could defeat user-side protection by training on external clean images; one testable check is whether retraining with heavy augmentation collapses the reported PSR gaps.
  • The exclusion of obfuscation methods from the quantitative runs, because their code is unavailable, leaves open the possibility that diffusion-based anonymization would outperform perturbation methods on the same PSR/SSIM scale.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper surveys methods for preserving facial image privacy in cloud-based services, dividing them into image obfuscation-based and adversarial perturbation-based approaches. It provides qualitative comparisons through two tables, a quantitative comparison of six adversarial perturbation methods using protection success rate (PSR) and SSIM on CASIA-WebFace and LFW, and a discussion of future research directions. The abstract claims a comprehensive review with qualitative and quantitative comparisons of both categories.

Significance. If the quantitative comparison were reliable, the survey would provide a useful structured overview and a comparative baseline for adversarial perturbation-based facial privacy protection. The categorization into obfuscation and perturbation methods, the qualitative tables, and the proposed research directions are reasonable and potentially helpful to researchers entering the field. However, the quantitative evaluation is the paper's distinctive contribution, and its credibility is currently undermined by protocol mismatches that make the reported rankings unreliable.

major comments (2)
  1. [Section IV-B, first experiment] The evaluation protocol used for EM, REM, and OPOM is to train a face recognition model on 80% protected images and test on 20% clean images. This is appropriate for EM and REM, which are unlearnable-example (data-poisoning) methods, but not for OPOM, which is an inference-time adversarial cloak optimized to be added at test time. Evaluating OPOM under a training-time poisoning protocol measures something other than its intended use, so the low PSR reported for OPOM in Fig. 2 should not be interpreted as a fair assessment of its protection effectiveness.
  2. [Section IV-B, second experiment] The protocol used for APF, Fawkes, and TIP-IM is to feed protected images directly to a pretrained ArcFace model and compute PSR. This is suitable for APF and TIP-IM, which are inference-time adversarial perturbations, but not for Fawkes, which is designed to prevent a model from learning to recognize cloaked images during training, as the paper itself notes in Section III-B. The low PSR for Fawkes in Fig. 3 is likely an artifact of evaluating it at inference time on a model that was never trained on Fawkes-cloaked images. The comparison therefore does not fairly represent each method's intended threat model, and the quantitative rankings in Figs. 2-3 do not support the paper's comparative claims.
minor comments (5)
  1. [Section IV-B] The sentence 'The comparison results of these four methods are shown in Fig. 2 and Fig. 4' should say 'three methods,' since Fig. 2 compares EM, REM, and OPOM only.
  2. [Section IV-B] In the description of the second experiment, 'we calculated the PSA' should be 'we calculated the PSR,' because the metric is protection success rate throughout.
  3. [Abstract and Section IV-B] The abstract claims 'quantitative comparisons of their effectiveness' for both categories, but Section IV-B explicitly states that quantitative evaluation is performed only for adversarial perturbation methods because codes for most obfuscation methods are unavailable. The abstract should be qualified to avoid overstating the coverage.
  4. [Section III-B and Section IV-B] The abbreviation MMD is expanded inconsistently: 'Max Mean Discrepancy' in Section III-B and 'maximum average difference' in Section IV-B. The correct term is Maximum Mean Discrepancy; please harmonize.
  5. [Section IV-A] The statement that 'only EM, REM, APF, and Fawkes can also maintain the protection ability' in out-of-distribution data leakage scenarios is too strong, because other methods are marked 'Not discussed' in Table II rather than shown ineffective; the wording should reflect the lack of evidence.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the survey's taxonomy and comparisons are descriptive and externally reproduced, not derived from their own inputs.

full rationale

This is a survey with no formal derivation chain, so there is no fitted parameter renamed as a prediction and no construction that makes an output equal to an input by definition. The taxonomy (image obfuscation versus adversarial perturbation) is a descriptive classification of existing methods, not a result derived from its own categories. The quantitative comparison in Section IV-B reruns the original source codes of EM, REM, OPOM, APF, Fawkes, and TIP-IM under a stated protocol; even if the protocol does not match each method's intended threat model, that is an experimental validity concern, not circular reasoning, because the reported PSR and SSIM values are not fitted to match the paper's conclusions nor derived from them. No load-bearing self-citation is present: OPOM is cited but is not authored by this paper's authors, and no uniqueness theorem or prior result by the same authors is invoked to force a choice. The paper is self-contained as a literature review and comparison, so the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper proposes no new entities, forces, or quantities; it is a survey. The main implicit assumptions are that the selected methods and evaluation settings are representative and fairly executed.

assumptions (3)
  • domain assumption The cited papers' descriptions and reported results are accurately summarized in Sections III and IV.
    The survey's value depends on accurate representation of prior work.
  • domain assumption The face recognition models and datasets used in the evaluation (CASIA-WebFace, LFW, Inception ResNet, ArcFace) are representative and the experimental protocol is fair to all compared methods.
    The quantitative comparison in Section IV asks the reader to treat the PSR/SSIM numbers as comparable evidence.
  • domain assumption The category scheme (obfuscation vs. adversarial perturbation) is a meaningful partition of the field.
    The framing of the whole survey relies on this taxonomy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Survey on Facial Image Privacy Preservation in Cloud-Based Services." pith.science (2026). https://pith.science/paper/ISBWFU7A

@misc{pith2026250108665,
  author       = {Pith},
  title        = {Pith review of: A Survey on Facial Image Privacy Preservation in Cloud-Based Services},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ISBWFU7A}},
  note         = {Machine review of arXiv:2501.08665}
}
read the original abstract

Facial recognition models are increasingly employed by commercial enterprises, government agencies, and cloud service providers for identity verification, consumer services, and surveillance. These models are often trained using vast amounts of facial data processed and stored in cloud-based platforms, raising significant privacy concerns. Users' facial images may be exploited without their consent, leading to potential data breaches and misuse. This survey presents a comprehensive review of current methods aimed at preserving facial image privacy in cloud-based services. We categorize these methods into two primary approaches: image obfuscation-based protection and adversarial perturbation-based protection. We provide an in-depth analysis of both categories, offering qualitative and quantitative comparisons of their effectiveness. Additionally, we highlight unresolved challenges and propose future research directions to improve privacy preservation in cloud computing environments.

Figures

Figures reproduced from arXiv: 2501.08665 by the authors.

Figure 1
Figure 1. Protecting private facial privacy from unauthorized exploitation in cloud-based services. photos to cloud platforms for storage or processing, users can add perturbations to these images to make them “unlearnable” by commercial face recognition models. Even when large volumes of such protected images are processed in the cloud, the performance of face recognition models degrades to a level similar to random guessing… view at source ↗
Figure 2
Figure 2. Comparison of facial privacy protection performance of EM [11], [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Comparison of facial privacy protection performance of APF [14], [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Visual comparison results of different facial privacy protection methods. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references · 15 canonical work pages

  1. [1]

    Biometric identification for a secured environment using ai-based facial recognition

    P. Shivanna and S. S. Venkatesiah, “Biometric identification for a secured environment using ai-based facial recognition.” International Journal of Safety & Security Engineering , vol. 14, no. 1, 2024

    work page 2024

  2. [2]

    Validating privacy-preserving face recognition under a minimum assumption,

    H. Zhang, X. Dong, Y . Lai, Y . Zhou, X. Zhang, X. Lv, Z. Jin, and X. Li, “Validating privacy-preserving face recognition under a minimum assumption,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 205–12 214

    work page 2024

  3. [3]

    Opom: Customized invisible cloak towards face privacy protection,

    Y . Zhong and W. Deng, “Opom: Customized invisible cloak towards face privacy protection,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022

    work page 2022

  4. [4]

    Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,

    S. Hu, X. Liu, Y . Zhang, M. Li, L. Y . Zhang, H. Jin, and L. Wu, “Protecting facial privacy: Generating adversarial identity masks via style-robust makeup transfer,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 014–15 023

    work page 2022

  5. [5]

    Towards face encryption by generating adversarial identity masks,

    X. Yang, Y . Dong, T. Pang, H. Su, J. Zhu, Y . Chen, and H. Xue, “Towards face encryption by generating adversarial identity masks,” in IEEE/CVF International Conference on Computer Vision , 2021, pp. 3897–3907

    work page 2021

  6. [6]

    Deepblur: A simple and effective method for natural image obfuscation,

    T. Li and M. S. Choi, “Deepblur: A simple and effective method for natural image obfuscation,” arXiv preprint arXiv:2104.02655 , vol. 1, 2021

    arXiv 2021

  7. [7]

    Gender-adversarial networks for face privacy preserving,

    D. Tang, S. Zhou, H. Jiang, H. Chen, and Y . Liu, “Gender-adversarial networks for face privacy preserving,” IEEE Internet of Things Journal , vol. 9, no. 18, pp. 17 568–17 576, 2022

    work page 2022

  8. [8]

    Diff-privacy: Diffusion- based face privacy protection,

    X. He, M. Zhu, D. Chen, N. Wang, and X. Gao, “Diff-privacy: Diffusion- based face privacy protection,” IEEE Transactions on Circuits and Systems for Video Technology, 2024

    work page 2024

Show all 16 references
  1. [9]

    Privacy-preserving optics for enhancing protection in face de-identification,

    J. Lopez, C. Hinojosa, H. Arguello, and B. Ghanem, “Privacy-preserving optics for enhancing protection in face de-identification,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 12 120–12 129

    2024

  2. [10]

    Transferable facial privacy protection against blind face restoration via domain-consistent adversarial obfuscation,

    K. Zhang, H. Zhou, J. Zhang, W. Zhou, W. Zhang, and N. Yu, “Transferable facial privacy protection against blind face restoration via domain-consistent adversarial obfuscation,” in International Conference on Machine Learning , 2024

    2024

  3. [11]

    Unlearnable examples: Making personal data unexploitable,

    H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y . Wang, “Unlearnable examples: Making personal data unexploitable,” in International Con- ference on Learning Representations . OpenReview.net, 2021

    2021

  4. [12]

    Robust unlearnable examples: Protecting data privacy against adversarial learning,

    S. Fu, F. He, Y . Liu, L. Shen, and D. Tao, “Robust unlearnable examples: Protecting data privacy against adversarial learning,” in International Conference on Learning Representations . OpenReview.net, 2021

    2021

  5. [13]

    Makeup-guided facial privacy protection via untrained neural network priors,

    F. Shamshad, M. Naseer, and K. Nandakumar, “Makeup-guided facial privacy protection via untrained neural network priors,” in ECCV Work- shop on Explainable AI for Biometrics , 2024

    2024

  6. [14]

    Adversarial privacy-preserving filter,

    J. Zhang, J. Sang, X. Zhao, X. Huang, Y . Sun, and Y . Hu, “Adversarial privacy-preserving filter,” in ACM International Conference on Multi- media, 2020, pp. 1423–1431

    2020

  7. [15]

    Fawkes: Protecting privacy against unauthorized deep learning models,

    S. Shan, E. Wenger, J. Zhang, H. Li, H. Zheng, and B. Y . Zhao, “Fawkes: Protecting privacy against unauthorized deep learning models,” in USENIX Security Symposium , 2020, pp. 1589–1604. Chen Chen received his B.S. degree from the University of Science and technology Beijing,...

    2020

  8. [2015]

    Top Minds

    She is currently a Bairen researcher in Zhejiang University, China. Her research interests include spectrum management for Femtocell networks, network economics, network security, AI security, and Quality of Experience (QoE) of multimedia delivery/distribution. Qian Wang is a ...

    2018

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.